Прямой сервис
WA Forensic
Read-only mobile forensic analysis for legally acquired iOS backups, WhatsApp databases, deleted-message traces, reports, and chain of custody.
Задача
WhatsApp evidence rarely arrives clean. An investigation may start from an iOS backup, SQLite databases, exported chats, media references or partial artefacts from a prior acquisition. Deleted messages, emptied chats and revoked-message records may leave residual traces, but they must be handled conservatively: overclaiming is as risky as missing the evidence.
Наш подход
WA Forensic is a read-only workflow for authorised forensic work. It examines WhatsApp databases and related iOS artefacts, extracts structured evidence, attempts best-effort recovery from SQLite WAL, freelist and free-block areas, and preserves technical provenance with hashes, offsets, confidence levels and a hash-linked chain of custody. The platform does not bypass end-to-end encryption, brute-force credentials or access devices without authorisation.
Mobile evidence
Deleted-message recovery without overclaiming.
WA Forensic separates evidence, probability and technical impossibility so findings remain useful in sensitive investigations.
The system searches where forensic remnants realistically survive: live records, revoked-message metadata, WAL frames, SQLite freelists, free blocks and related iOS artefacts.
Every candidate fragment is recorded with source metadata and a normalised hash, allowing reviewers to distinguish a strong finding from a partial or unattributable fragment.
The reporting model is deliberately conservative. When encryption, overwritten pages or missing keys make recovery infeasible, the limitation is documented.
Forensic capabilities
- Read-only analysis of acquired evidence
- WhatsApp SQLite and WAL inspection
- Deleted-fragment carving
- Revoked-message and emptied-session extraction
- Cross-source timeline support
- Confidence scoring and deduplication
- Hash-linked chain of custody
- JSON, CSV and summary reporting
Typical use cases
- Internal investigations involving authorised mobile evidence
- Litigation support and preliminary expert review
- Private forensic triage before laboratory escalation
- Audit-ready documentation of methods, artefacts, hashes and limits
Что входит
Что входит
- Analysis of ChatStorage.sqlite, ChatStorage.sqlite-wal, ExtChatDatabase.sqlite, LID.sqlite, CallHistory.sqlite and related iOS artefacts
- Extraction of revoked-message records, emptied chat sessions, contact identifiers, media references, timestamps and metadata
- Best-effort carving of readable deleted-message fragments from SQLite freelist pages, free blocks, WAL frames and residual data
- Candidate classification with confidence score, source type, source page, byte offset, byte length and SHA-256 hash
- JSON, CSV and readable summaries for review, disclosure and expert handover
- Hash-linked chain-of-custody log for acquisition, processing, outputs and integrity verification
Формат сотрудничества
Engagements begin with scoping: authority or consent, device or backup status, acquisition method, jurisdictional constraints and reporting expectations. FRT can analyse already acquired backups, structure a defensible workflow, or prepare technical triage for escalation to a certified digital forensics laboratory.
География
WA Forensic is intended only for lawful, authorised forensic work. Deleted content is recoverable only when readable remnants still exist in the backup, SQLite database, WAL, freelist, cache or supporting artefacts. Encrypted WhatsApp or Signal material cannot be reconstructed when the required keys are absent from the acquired evidence.
FAQ
Частые вопросы.
- Can WA Forensic recover deleted WhatsApp messages?
- Sometimes. It can recover readable remnants that still exist in databases, WAL files, SQLite freelists, free blocks, caches or related artefacts. It cannot recover content that has been overwritten or was never present in the acquired material.
- Does it bypass WhatsApp encryption?
- No. WA Forensic does not break end-to-end encryption, brute-force credentials or reconstruct Signal keys that are not present in the evidence. This limitation is documented.
- What evidence sources are supported?
- The workflow focuses on legally acquired iOS backups and WhatsApp databases such as ChatStorage.sqlite, ChatStorage.sqlite-wal, ExtChatDatabase.sqlite, LID.sqlite and CallHistory.sqlite.
- Is the workflow suitable for legal or HR use?
- It supports defensible review, but legal, HR or disciplinary use depends on jurisdiction, authority, privacy notices and acquisition method.
- What outputs are produced?
- JSON, CSV, readable summaries, SHA-256 hashes, source offsets, confidence labels and a hash-linked chain-of-custody log.
Готовы обсудить — WA Forensic?
Пришлите конфиденциальный бриф. Ответим в течение одного рабочего дня и назначим координатора.